fa3709a30ec803f754f2cf962a6e7edf95f934c86accdb051e05285dbadccdae

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_85a54b6c066d547b636f596daf7b5195_amadey_elex_smoke-loader.exe
Size 4.4MB
Sample260423-ecy4msas2v
SHA256 fa3709a30ec803f754f2cf962a6e7edf95f934c86accdb051e05285dbadccdae
MD5 85a54b6c066d547b636f596daf7b5195
SHA1 9c94a5fadf7fbf69dac84f6aadf3bb8bff0d34a5
SHA512 db2df31cbc57be0dd9e88916a76a8481fd1ff11df7ab3b30f28ec1bfe9c740d464186cd9fb30651a9b075c5112b587034699af9852b7674793696e9dbfa2f0ca
SSDEEP 98304:tmhd1UryebfCVITrSm0nVLUjH5oxFbxCVLUjH5oxFbxe:tl7fXrSrnVUjZEdCVUjZEde
TLSH
T1E3262300BB54B4E3C241BEF4648797DB93307E6B3B25A98B1E84231E9CDF5C5AB61B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4908	1095.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_85a54b6c066d547b636f596daf7b5195_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1095.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4908	4788	2026-04-23_85a54b6c066d547b636f596daf7b5195_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-23_85a54b6c066d547b636f596daf7b5195_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_85a54b6c066d547b636f596daf7b5195_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\1095.tmp
  "C:\Users\Admin\AppData\Local\Temp\1095.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-04-23_85a54b6c066d547b636f596daf7b5195_amadey_elex_smoke-loader.exe 53C9C6C2D201A8AC6176CC807FB24BA112B4BDF2007843D0F8AF61FEB5BB1A810385D942C6820F677162F3A688D3BE4B9D6F6AB7C302A90F52B1E068E5F00EF2
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1095.tmp

Path C:\Users\Admin\AppData\Local\Temp\1095.tmp
Size 4.4MB
SHA256 f6414e3830ab64ce8b095bd0ab1c189b25b9ec1f9dcb2627486af19c379c5eda
MD5 0cc13a72d9aa012fad99a36de6226cd7
SHA1 4f77a6d05fd391995eb4e13a5eee4ef66dd974ab
SHA512 2e6634b3795418b2c7f2b92f4faaec73250340d8eac75b851cca938c33cef53b6644f14a6087baf0db07d73682f787351b33f70a84215b719ecd96acdd4a9714
SSDEEP 98304:tmhd1Uryei5yGl6SgUQXUciVLUjH5oxFbxCVLUjH5oxFbxe:tlCwm6VyVUjZEdCVUjZEde
TLSH
T12A262300B744B4E3C251BAF4644797DB93207E6B3B25E88B1DC8274ECCDE5C9AB66B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download